@hellolynk-ai/codex-plugin 0.2.102-macos.1 → 0.2.103-macos.1

package/bin/hellolynk-client-setup.mjs

@@ -16,7 +16,8 @@ const PACK_PIN = "hellolynk-client-pack-pin.json";
 
 // A person at a terminal reads sentences in the system language; the updater, tests and other
 // programs read one JSON line.
-const jsonOutput = process.argv.includes("--json") || process.stdout.isTTY !== true;
+const explicitJson = process.argv.includes("--json");
+const jsonOutput = explicitJson || process.stdout.isTTY !== true;
 const CHINESE = /^zh\b/i.test(Intl.DateTimeFormat().resolvedOptions().locale);
 const CLIENT_NAMES = Object.freeze({ codex: "Codex", openclaw: "OpenClaw", "trae-work": "TRAE Work",
   workbuddy: "WorkBuddy", cursor: "Cursor", dsh: "DSH" });
@@ -258,6 +259,10 @@ try {
       await verifyExactBinding({ ...installed, locations, activation });
       await verifyClientConfiguration({ ...installed, locations });
     }
+    // A running unsigned updater asks the stable package for implicit JSON. A
+    // staged package may still prove its own first install after lost stdout.
+    const legacyUpdateProof = installed && !existingDoctor && !explicitJson && jsonOutput
+      && process.env.HELLOLYNK_NEUTRAL_STORE_ROOT && samePath(PACKAGE_ROOT, installed.packageRoot);
     print({
       ok: true,
       client: metadata.client,
@@ -268,7 +273,7 @@ try {
       activated: activation.ready,
       activationState: activation.state,
       stableReleaseVerified: installed != null,
-      exactBindingVerified: installed != null,
+      ...(legacyUpdateProof ? {} : { exactBindingVerified: installed != null }),
       clientConfigurationVerified: installed != null,
       installsNode: false,
       installsGit: false,

package/hellolynk-client-pack-manifest.json

@@ -2,7 +2,7 @@
   "contract": "hellolynk-client-npm-pack-manifest-v1",
   "client": "codex",
   "packageName": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.102-macos.1",
+  "version": "0.2.103-macos.1",
   "workbench": {
     "path": "plugins/hellolynk-codex/runtime/workbench/hellolynk-workbench-build.json",
     "contract": "hellolynk-shared-workbench-build-v1",
@@ -17,8 +17,8 @@
     },
     {
       "path": "bin/hellolynk-client-setup.mjs",
-      "bytes": 145198,
-      "sha256": "d7ab5068d7c88f4cdcd056db0074431ea33811a538c2ede4a420d1ee15f4452c"
+      "bytes": 145615,
+      "sha256": "044321ea6c5757a985b92a826ffc1fb3ffa4fb8355b732abecc64210d4ac3399"
     },
     {
       "path": "bin/hellolynk-mcp-config-shape.mjs",
@@ -33,7 +33,7 @@
     {
       "path": "package.json",
       "bytes": 1776,
-      "sha256": "8b20a1dc094f4e846029478dfb1d4f11b827c0e6edd1d5646eea02459b6480c0"
+      "sha256": "4115862c2d4169f3876fe2c35a3a96c8c1fb50b6a3a73af80456e26702ad3105"
     },
     {
       "path": "plugins/hellolynk-codex/.app.json",
@@ -43,7 +43,7 @@
     {
       "path": "plugins/hellolynk-codex/.codex-plugin/plugin.json",
       "bytes": 1669,
-      "sha256": "38d2a5204b66ec57368494e69ed71de655f798f9d37ab2af966b59c3ab07d0f2"
+      "sha256": "1de6bb823a304b733c0c75418389b1e32819191adea03c575f5c602f2e00631c"
     },
     {
       "path": "plugins/hellolynk-codex/.mcp.json",
@@ -58,7 +58,7 @@
     {
       "path": "plugins/hellolynk-codex/package.json",
       "bytes": 1030,
-      "sha256": "befbca064334e8ff7f9d192f095ac1bd786a3882385a450fc2c2d2a5c9b2b7dd"
+      "sha256": "f786baab2e9f35836813c6b77e1cbc0fb8c0a3c0a2055b2e6ea777f2428cd232"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-client-account.mjs",
@@ -77,8 +77,8 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-darwin-host.mjs",
-      "bytes": 14704,
-      "sha256": "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"
+      "bytes": 15242,
+      "sha256": "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-darwin-vault.mjs",
@@ -157,18 +157,18 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-client-update-entry.mjs",
-      "bytes": 1935,
-      "sha256": "1e513a4a98437dc60b49f9f39fc3958808c3acfaeb6c5bb638efea2e61d4b1ee"
+      "bytes": 1939,
+      "sha256": "d9548eacda8632976e42aafc65f0cef2ec9c5233d2d53b31b02aec0a1702b5eb"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-client-update-runtime.mjs",
-      "bytes": 40918,
-      "sha256": "96aa12ba21619a0cd78ef61c63be6f43fdb61f892201ce923ee35e0912ae2e52"
+      "bytes": 41618,
+      "sha256": "aa233e2cdbdfadb7da6aa489591bc12c4121101b94696f93f6e6cb5d3e7c7870"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-client-update.mjs",
-      "bytes": 28747,
-      "sha256": "93bf5f2ecc72731d70367306989fa18c82fa7bf9e4b5f785a1376f0d55239428"
+      "bytes": 30894,
+      "sha256": "e57f7cc5e98519a014cef7cef68a97bb7e2beb33eb381c38d1751a3967904aaa"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-contact-request-e2ee.mjs",
@@ -177,8 +177,8 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-darwin-host.mjs",
-      "bytes": 14704,
-      "sha256": "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"
+      "bytes": 15242,
+      "sha256": "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-darwin-vault.mjs",
@@ -348,7 +348,7 @@
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-process.mjs",
       "bytes": 225161,
-      "sha256": "e744bacf65f7b86cbcf7d654189c0e07e09401083e2b6f9053b17c1c3bacd1b4"
+      "sha256": "7b237a1400c604da5decbb29ab3ce556fd1b744d0cfd7d28b5560b217da120b1"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -372,8 +372,8 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-release-retention.mjs",
-      "bytes": 24519,
-      "sha256": "7cfd7e20c37ac1479f2472cc5fba8e830dcd1b83b91a86c340749cf145f0d661"
+      "bytes": 25616,
+      "sha256": "0ee150af5a9bcc1f636e3ff980ee90ce7d073ab5ed4a991920cd3472bc65529c"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-runtime-safety.cjs",
@@ -408,12 +408,12 @@
     {
       "path": "plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json",
       "bytes": 14698,
-      "sha256": "2cc4af5084d836c44b30aa3f747ab0562980991edf78aba149aaded974d32b3c"
+      "sha256": "f054f0e73accc788fb24c437eea03a6e4cd5872f39dc4d65cbc7ff0e17e6bcae"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/neutral-host-release-pin.json",
       "bytes": 146,
-      "sha256": "ea352aec41635ec6e187bc3cfb76a0c35d0100a5628293b40c25ef049aa50650"
+      "sha256": "530ed943cd227874b5096c7bb3657ec0f7a624c2b049680003f6237574d9d73a"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.bin",
@@ -432,8 +432,8 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/platform/windows/credential-store.ps1",
-      "bytes": 38434,
-      "sha256": "d00dae4af08205fffa52c4956d1c87d5c3423e8f20982ccfc1b76e3424fe442e"
+      "bytes": 40188,
+      "sha256": "8f288c91a1f6ecaf2651baab9bdfc55014c11ea9e165f203ca7a69f4d47d7917"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/platform/windows/hellolynk-host-protected-store.ps1",
@@ -593,7 +593,7 @@
     {
       "path": "plugins/hellolynk-codex/server/codex-neutral-production.mjs",
       "bytes": 27551,
-      "sha256": "2e09f95b8c15ac307d3be0e5b29fecd00e5eae95fd816e885c51484990e703cb"
+      "sha256": "2c2f209339385cc14f27fe985f4deb75f4bd48e689035311847cc3b08e36ac52"
     },
     {
       "path": "plugins/hellolynk-codex/server/mcp-proxy.mjs",
@@ -602,13 +602,13 @@
     },
     {
       "path": "plugins/hellolynk-codex/server/mcp-server.mjs",
-      "bytes": 59270,
-      "sha256": "2333f154c55b629a4a789b640be7099bbb8a84e90a17f84b77830210b527387a"
+      "bytes": 60463,
+      "sha256": "d20e041d6ce63c52bbdf7faac7e7c2ed288444fca014f861f1a8eb15d8067497"
     },
     {
       "path": "plugins/hellolynk-codex/server/native-conversation-directory.mjs",
-      "bytes": 2319,
-      "sha256": "382ca445887ef518d9fd58c7fdf18c55e8865623102396822d73df5f987b1b3d"
+      "bytes": 2352,
+      "sha256": "d6e3c1bd6e338bb13518760e0d2a350d3c9a28ef0a493bcbd53b44c610bfd56d"
     },
     {
       "path": "plugins/hellolynk-codex/server/native-reply-routes.mjs",
@@ -632,8 +632,8 @@
     },
     {
       "path": "plugins/hellolynk-codex/server/workbench-runtime.mjs",
-      "bytes": 8860,
-      "sha256": "99e069a72a0be3e73a993b2092d55470fcb481eb381841a156b2756415a0a0a9"
+      "bytes": 8902,
+      "sha256": "1136c7ea50cc73065fe04094c5b5c19cb676c40a0a189979015766a9c4e908d8"
     },
     {
       "path": "plugins/hellolynk-codex/skills/hellolynk-open/agents/openai.yaml",

package/hellolynk-client-pack-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-client-npm-pack-pin-v1",
-  "manifestSha256": "20c169b5149efb01cd3ac7d550b61f2959a491fe9e5c5d44f6106643aefdf65d"
+  "manifestSha256": "23e0c7dae786144392b74ba3ee2c6b4b5221d65410ddb563c207ab2022902f87"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.102-macos.1",
+  "version": "0.2.103-macos.1",
   "description": "HelloLynk Messaging for Codex: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {

package/plugins/hellolynk-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hellolynk-codex",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "description": "HelloLynk 通讯、本地未读提醒与安全文字收发的 Codex 插件。",
   "author": {
     "name": "HelloLynk local project"

package/plugins/hellolynk-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "private": true,
   "type": "module",
   "description": "Project-local HelloLynk Messaging, unread notification, and secure messaging plugin for Codex.",

package/plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-darwin-host.mjs

@@ -12,13 +12,13 @@ function unique(records, missing, ambiguous) {
   if (records.length !== 1) fail(records.length ? ambiguous : missing);
   return records[0];
 }
-function checkBindingPaths(b) {
+function checkBindingPaths(b, code) {
   try {
     checkDarwinPath(b.runtimeRoot, { directory: true });
     checkDarwinPath(b.releaseRoot, { directory: true });
     if (checkDarwinPath(b.profileManifestPath).size > 65536 ||
-        checkDarwinPath(join(b.releaseRoot, b.runnerRelativePath)).size > 1048576) fail("neutral_codex_launch_manifest_invalid");
-  } catch { fail("neutral_codex_launch_manifest_invalid"); }
+        checkDarwinPath(join(b.releaseRoot, b.runnerRelativePath)).size > 1048576) fail(code);
+  } catch { fail(code); }
 }
 function capMatches(cap, b) {
   return cap.state === "active" && fieldsMatch(cap, b,
@@ -38,51 +38,60 @@ function revokeCapability(s, r) {
   }
   return { capabilityId: r.capabilityId, revokedAt: r.revokedAt, state: "revoked" };
 }
-function codexBinding(s, command, input, oldId) {
-  const b = s.codex;
-  if (command === "ResolveCodexNeutralBinding" || command === "VerifyCodexNeutralBinding") {
-    if (!b) fail("neutral_codex_binding_configuration_required");
-    checkBindingPaths(b);
-    const active = s.caps.filter(c => c.adapterId === "codex" && c.state === "active");
+function neutralBinding(s, adapter, action, input, oldId) {
+  const codex = adapter === "codex";
+  const key = codex ? "codex" : "claudeCode";
+  const error = suffix => `neutral_${adapter.replace("-", "_")}_${suffix}`;
+  const check = binding => checkBindingPaths(binding, error("launch_manifest_invalid"));
+  const b = s[key];
+  if (action === "Resolve" || action === "Verify") {
+    if (!b) fail(error("binding_configuration_required"));
+    // Claude retains its identity across uninstall; Verify can inspect a
+    // retained binding whose old release is gone. Resolve always needs it.
+    if (codex || action === "Resolve") check(b);
+    const active = s.caps.filter(c => c.adapterId === adapter && c.state === "active");
     const cap = unique(active.filter(c => capMatches(c, b)),
-      active.length ? "neutral_codex_capability_binding_mismatch" : "neutral_codex_capability_missing", "neutral_codex_capability_ambiguous");
-    if (command.startsWith("Resolve")) return { binding: b, record: cap };
+      error(active.length ? "capability_binding_mismatch" : "capability_missing"), error("capability_ambiguous"));
+    if (action === "Resolve") return { binding: b, record: cap };
     const {secret, ...record} = cap;
     return { binding: b, record };
   }
-  if (command === "SaveCodexNeutralBinding" || command === "RemoveCodexNeutralBinding") {
-    checkBindingPaths(input);
-    if (command.startsWith("Remove")) {
-      if (!equal(b, input)) fail("neutral_codex_binding_invalid");
-      s.codex = null;
+  if (action === "Save" || action === "Remove") {
+    if (input.adapterId !== adapter) fail(error("binding_invalid"));
+    if (action === "Remove") {
+      if (codex) check(input);
+      if (!equal(b, input)) fail(error("binding_invalid"));
+      if (codex) s.codex = null;
+      else delete s.claudeCode;
       return { removed: true };
     }
-    if (b && !equal(b, input)) fail("neutral_codex_binding_invalid");
-    s.codex = input;
+    check(input);
+    if (b && !equal(b, input)) fail(error("binding_invalid"));
+    s[key] = input;
     return { binding: input };
   }
   const { previousBinding: previous, replacementBinding: next, replacementRecord } = input;
-  checkBindingPaths(previous);
-  checkBindingPaths(next);
-  if (!fieldsMatch(previous, next, ["contract","region","principalId","delegateId","hostInstallationId","profileId","adapterId","version","runtimeRoot"])) {
-    fail("neutral_codex_capability_binding_mismatch");
+  if (codex) check(previous);
+  check(next);
+  if (next.adapterId !== adapter || !fieldsMatch(previous, next, ["contract","region","principalId","delegateId","hostInstallationId","profileId","adapterId","version","runtimeRoot"])) {
+    fail(error("capability_binding_mismatch"));
   }
-  if (!equal(b, previous)) fail("neutral_codex_binding_invalid");
+  if (!equal(b, previous)) fail(error("binding_invalid"));
   const active = s.caps.filter(c => capMatches(c, next));
-  if (command === "ReplaceCodexNeutralBinding") {
-    if (!equal(previous.scopes, next.scopes)) fail("neutral_codex_capability_binding_mismatch");
-    if (active.length !== 1) fail("neutral_codex_capability_ambiguous");
-    s.codex = next;
+  if (codex && action === "Replace") {
+    if (!equal(previous.scopes, next.scopes)) fail(error("capability_binding_mismatch"));
+    if (active.length !== 1) fail(error("capability_ambiguous"));
+    s[key] = next;
     return { binding: next };
   }
-  if (command !== "MigrateCodexNeutralBinding") fail("host_protected_store_command_invalid");
+  if (action !== "Migrate") fail("host_protected_store_command_invalid");
   const old = s.caps.find(c => c.capabilityId === oldId);
-  if (!old || !capMatches(old, previous) || !capMatches(replacementRecord, next)) fail("neutral_codex_capability_binding_mismatch");
+  if (!old || !capMatches(old, previous) || !capMatches(replacementRecord, next)) fail(error("capability_binding_mismatch"));
   const other = active.filter(c => c.capabilityId !== oldId);
-  if (other.length > 1) fail("neutral_codex_capability_ambiguous");
+  if (other.length > 1) fail(error("capability_ambiguous"));
   if (!other.length) addCapability(s, replacementRecord);
   revokeCapability(s, old);
-  s.codex = next;
+  s[key] = next;
   return { binding: next, record: other[0] || replacementRecord, replacedCapabilityId: oldId };
 }
 
@@ -247,9 +256,13 @@ export function invokeDarwinHost(q) {
       case "DisconnectLocalClient":
         for (const cap of s.caps.filter(c => c.adapterId === input.client && c.state === "active")) revokeCapability(s,cap);
         if (input.client === "codex") s.codex = null;
+        if (input.client === "claude-code") delete s.claudeCode;
         return {disconnected:true,client:input.client};
     }
-    if (q.command.endsWith("CodexNeutralBinding")) return codexBinding(s,q.command,input,q.capabilityId);
+    const bindingCommand = /^(Resolve|Verify|Save|Remove|Replace|Migrate)(Codex|ClaudeCode)NeutralBinding$/.exec(q.command);
+    if (bindingCommand) {
+      return neutralBinding(s, bindingCommand[2] === "Codex" ? "codex" : "claude-code", bindingCommand[1], input, q.capabilityId);
+    }
     if (q.command.includes("Transport")) return transport(s,q,input);
     fail("host_protected_store_command_unsupported");
   });

package/plugins/hellolynk-codex/runtime/core/hellolynk-client-update-entry.mjs

@@ -2,7 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { clientAccountBaseRoot } from "./hellolynk-client-account.mjs";
 import { startClientUpdateRuntime } from "./hellolynk-client-update-runtime.mjs";
-import { clientUpdateCatalogId, MAC_CODEX_VERSION } from "./hellolynk-client-update.mjs";
+import { clientUpdateCatalogId, MAC_CLIENT_VERSION } from "./hellolynk-client-update.mjs";
 
 const running = new Map();
 
@@ -11,7 +11,7 @@ const running = new Map();
 export function startInstalledClientUpdate(options = {}) {
   const { client, packageRoot, storeRoot } = options;
   const catalogId = clientUpdateCatalogId(client, process.platform);
-  const mac = catalogId === "codex-macos";
+  const mac = process.platform === "darwin";
   if (!catalogId || (mac && process.arch !== "arm64") || !path.isAbsolute(String(packageRoot || ""))) return Promise.resolve(null);
   let baseRoot;
   try { baseRoot = clientAccountBaseRoot(storeRoot); } catch { return Promise.resolve(null); }
@@ -24,7 +24,7 @@ export function startInstalledClientUpdate(options = {}) {
     const metadata = await fs.lstat(packageFile);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size > 64 * 1024) return null;
     const manifest = JSON.parse(await fs.readFile(packageFile, "utf8"));
-    const version = mac ? MAC_CODEX_VERSION : /^\d+\.\d+\.\d+$/u;
+    const version = mac ? MAC_CLIENT_VERSION : /^\d+\.\d+\.\d+$/u;
     if (manifest.hellolynkClient?.client !== client || !version.test(manifest.version || "")
       || (mac && (manifest.os?.[0] !== "darwin" || manifest.cpu?.[0] !== "arm64"))) return null;
     return startClientUpdateRuntime({

package/plugins/hellolynk-codex/runtime/core/hellolynk-client-update-runtime.mjs

@@ -5,7 +5,7 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { createClientUpdateManager, extractClientUpdateArchive, compareClientUpdateVersions, clientUpdateCatalogId,
-  CLIENT_UPDATE_CLIENTS, MAC_CODEX_VERSION } from "./hellolynk-client-update.mjs";
+  CLIENT_UPDATE_CLIENTS, CLIENT_UPDATE_RELEASES, MAC_CLIENT_VERSION } from "./hellolynk-client-update.mjs";
 import { withNeutralHostStoreLock } from "./hellolynk-neutral-host-installation-store.mjs";
 import { readClientAccount } from "./hellolynk-client-account.mjs";
 import runtimeSafety from "./hellolynk-runtime-safety.cjs";
@@ -95,7 +95,7 @@ export async function runClientUpdateWorker(options = {}) {
 function createRuntime(config, options) {
   const { root, client, currentVersion, installContext } = config;
   const directory = path.join(root, "client-updates", client);
-  const statePath = path.join(directory, "runtime.json"), leasePath = path.join(directory, "leases.json"), installedPath = path.join(directory, "installed.json");
+  const statePath = path.join(directory, "runtime-v2.json"), leasePath = path.join(directory, "leases.json"), installedPath = path.join(directory, "installed.json");
   const manager = createClientUpdateManager({ ...options, root, client, currentVersion, platform: config.platform });
   const alive = options.isProcessAlive || processAlive;
   async function gate(operation) {
@@ -201,7 +201,8 @@ function createRuntime(config, options) {
       const attempted = runtime.sha256 === downloaded.sha256 && !(runtime.stage === "applying" || retryable);
       if (downloaded.stage !== "downloaded" || downloaded.error || attempted) return;
       // A damaged worker record means no known worker.
-      const worker = await readJson(path.join(directory, "worker.json"), null).catch((error) => { if (!damaged(error)) throw error; return null; });
+      const workerPath = path.join(directory, "worker-v2.json");
+      const worker = await readJson(workerPath, null).catch((error) => { if (!damaged(error)) throw error; return null; });
       if (worker?.client === client && Number.isSafeInteger(worker.pid) && alive(worker.pid)) return;
       const launch = options.spawnWorker || launchWorker;
       let pid;
@@ -211,13 +212,13 @@ function createRuntime(config, options) {
       } catch (error) {
         // Retain only this rejected launch attempt, not raw errors or proof of
         // worker absence. Keep an earlier PID's conservative liveness check.
-        await atomicJson(path.join(directory, "worker.json"), { client,
+        await atomicJson(workerPath, { client,
           ...(worker?.client === client && Number.isSafeInteger(worker.pid) ? { pid: worker.pid } : {}),
           sha256: downloaded.sha256, error: "client_update_worker_launch_failed", failedAt: Date.now(),
         }).catch(() => {});
         throw error;
       }
-      await atomicJson(path.join(directory, "worker.json"), { client, pid });
+      await atomicJson(workerPath, { client, pid });
     });
   }
   async function applyPending() {
@@ -237,7 +238,7 @@ function createRuntime(config, options) {
           if (sha(await safeFile(path.join(proof.packageRoot, "hellolynk-client-pack-manifest.json")))
             !== sha(await safeFile(path.join(installContext.packageRoot, "hellolynk-client-pack-manifest.json")))) throw failure("adoption_invalid");
           const doctor = await (options.runInstaller || runInstaller)({ executable: installContext.nodePath || process.execPath,
-            args: [path.join(installContext.packageRoot, "bin", "hellolynk-client-setup.mjs"), "doctor"], cwd: installContext.packageRoot, root, timeoutMs: 180_000 });
+            args: [path.join(installContext.packageRoot, "bin", "hellolynk-client-setup.mjs"), "doctor", "--json"], cwd: installContext.packageRoot, root, timeoutMs: 180_000 });
           if (!doctorProves(doctor, client, currentVersion)) throw failure("adoption_invalid");
           const adoptedRoot = path.join(path.dirname(root), "releases", `${client}-${sha(await safeFile(path.join(proof.packageRoot, "hellolynk-client-pack-manifest.json")))}`);
           if (!options.runInstaller) await verifyPackage(adoptedRoot, client, currentVersion);
@@ -275,7 +276,7 @@ function createRuntime(config, options) {
       try {
         await verifyPackage(packageRoot, client, version);
         const inspected = await run({ executable: installContext.nodePath || process.execPath,
-          args: [path.join(packageRoot, "bin", "hellolynk-client-setup.mjs"), "doctor"], cwd: packageRoot, root, timeoutMs: 180_000 });
+          args: [path.join(packageRoot, "bin", "hellolynk-client-setup.mjs"), "doctor", "--json"], cwd: packageRoot, root, timeoutMs: 180_000 });
         return doctorProves(inspected, client, version);
       } catch { return false; }
     };
@@ -398,7 +399,7 @@ async function prepareCandidate(config, record) {
   const directory = path.join(config.root, "client-updates", config.client);
   if (!HASH.test(record.sha256) || typeof record.version !== "string" || !/^[0-9A-Za-z.+-]{1,100}$/.test(record.version)
     || typeof record.filename !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}\.zip$/.test(record.filename)) throw failure("candidate_invalid");
-  const artifactPath = path.join(directory, "releases", `${record.version}-${record.sha256}`, record.filename);
+  const artifactPath = path.join(directory, CLIENT_UPDATE_RELEASES, `${record.version}-${record.sha256}`, record.filename);
   if (artifactPath !== record.artifactPath) throw failure("candidate_path_invalid");
   const archive = await safeFile(artifactPath, 64 * 1024 * 1024);
   if (archive.length !== record.bytes || sha(archive) !== record.sha256) throw failure("artifact_integrity_invalid");
@@ -407,51 +408,63 @@ async function prepareCandidate(config, record) {
   const extractedRoot = path.join(temporaryRoot, "extracted");
   try {
     // Re-extract the hash-verified archive; never execute a mutable earlier
-    // extractedRoot or an executable path supplied by state.json.
+    // extractedRoot or an executable path supplied by update state.
     const sealed = path.join(temporaryRoot, record.filename);
     await fs.writeFile(sealed, archive, { flag: "wx", mode: 0o600 });
     await extractClientUpdateArchive({ archivePath: sealed, destination: extractedRoot, platform: config.platform });
-    let packageRoot;
-    if (config.client === "dsh") {
-      const descriptor = await readJson(path.join(extractedRoot, "trusted-release.json"));
-      const manifestBytes = await safeFile(path.join(extractedRoot, "dist", "package", "hellolynk-dsh-nav-build.json"));
-      if (descriptor?.contract !== "hellolynk-dsh-nav-release-v1" || descriptor.manifestSha256 !== sha(manifestBytes)) throw failure("package_pin_invalid");
-      const manifest = JSON.parse(manifestBytes.toString("utf8"));
-      if (manifest.contract !== "hellolynk-dsh-nav-build-v3") throw failure("package_pin_invalid");
-      await verifyRecords(path.join(extractedRoot, "dist", "package"), manifest.packageFiles, ["hellolynk-dsh-nav-build.json"]);
-      packageRoot = path.join(extractedRoot, "dist", "package", "runtime", "connect");
-      await safeFile(path.join(extractedRoot, "scripts", "install.mjs"));
-    } else {
-      const id = clientUpdateCatalogId(config.client, config.platform) || config.client;
-      const candidates = [extractedRoot, path.join(extractedRoot, "package"), path.join(extractedRoot, `hellolynk-${id}-${record.version}`, "package")];
-      const matches = [];
-      for (const candidate of candidates) if (await exists(path.join(candidate, "package.json"))) matches.push(candidate);
-      if (matches.length !== 1) throw failure("package_identity_invalid");
-      packageRoot = matches[0];
-    }
-    await verifyPackage(packageRoot, config.client, record.version);
+    const { packageRoot } = await verifyExtractedClientUpdatePackage(extractedRoot,
+      { client: config.client, platform: config.platform, version: record.version });
     return { temporaryRoot, extractedRoot, artifactPath: sealed, packageRoot, setupPath: path.join(packageRoot, "bin", "hellolynk-client-setup.mjs") };
   } catch (error) { await fs.rm(temporaryRoot, { recursive: true, force: true }); throw error; }
 }
 
+export async function verifyExtractedClientUpdatePackage(extractedRoot, { client, platform, version }) {
+  if (!CLIENT_UPDATE_CLIENTS.includes(client) || typeof version !== "string" || !VERSION.test(version)) throw failure("package_identity_invalid");
+  let packageRoot;
+  if (client === "dsh") {
+    const descriptor = await readJson(path.join(extractedRoot, "trusted-release.json"));
+    const manifestBytes = await safeFile(path.join(extractedRoot, "dist", "package", "hellolynk-dsh-nav-build.json"));
+    if (descriptor?.contract !== "hellolynk-dsh-nav-release-v1" || descriptor.manifestSha256 !== sha(manifestBytes)) throw failure("package_pin_invalid");
+    const manifest = JSON.parse(manifestBytes.toString("utf8"));
+    if (manifest.contract !== "hellolynk-dsh-nav-build-v3") throw failure("package_pin_invalid");
+    await verifyRecords(path.join(extractedRoot, "dist", "package"), manifest.packageFiles, ["hellolynk-dsh-nav-build.json"]);
+    packageRoot = path.join(extractedRoot, "dist", "package", "runtime", "connect");
+    await safeFile(path.join(extractedRoot, "scripts", "install.mjs"));
+  } else {
+    const id = clientUpdateCatalogId(client, platform) || client;
+    const candidates = [extractedRoot, path.join(extractedRoot, "package"), path.join(extractedRoot, `hellolynk-${id}-${version}`, "package")];
+    const matches = [];
+    for (const candidate of candidates) if (await exists(path.join(candidate, "package.json"))) matches.push(candidate);
+    if (matches.length !== 1) throw failure("package_identity_invalid");
+    packageRoot = matches[0];
+  }
+  const checked = await verifyPackage(packageRoot, client, version);
+  return { packageRoot, ...checked };
+}
+
 async function verifyPackage(root, client, version) {
   const pkg = await readJson(path.join(root, "package.json"));
   const manifestBytes = await safeFile(path.join(root, "hellolynk-client-pack-manifest.json"));
   const pin = await readJson(path.join(root, "hellolynk-client-pack-pin.json"));
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
   if (pkg.version !== version || pkg.hellolynkClient?.client !== client || pkg.name !== NAMES[client]
-    || (MAC_CODEX_VERSION.test(version) && (client !== "codex" || pkg.os?.[0] !== "darwin" || pkg.cpu?.[0] !== "arm64"))
+    || (MAC_CLIENT_VERSION.test(version) && (!clientUpdateCatalogId(client, "darwin") || pkg.os?.[0] !== "darwin" || pkg.cpu?.[0] !== "arm64"))
     || manifest.contract !== "hellolynk-client-npm-pack-manifest-v1" || manifest.client !== client
     || manifest.packageName !== pkg.name || manifest.version !== version
     || pin.contract !== "hellolynk-client-npm-pack-pin-v1" || pin.manifestSha256 !== sha(manifestBytes)) throw failure("package_identity_invalid");
   await verifyRecords(root, manifest.files, ["hellolynk-client-pack-manifest.json", "hellolynk-client-pack-pin.json"]);
   if (!manifest.files.some((file) => file.path === "bin/hellolynk-client-setup.mjs")) throw failure("package_pin_invalid");
-  if (process.platform !== "win32" && MAC_CODEX_VERSION.test(version)) {
-    for (const relative of ["platform/darwin", "bootstrap/platform/darwin"]) {
-      const helper = path.join(root, "plugins/hellolynk-codex/runtime", relative, "hellolynk-keychain-helper.bin");
-      if (!((await fs.lstat(helper)).mode & 0o100)) throw failure("package_pin_invalid");
+  if (MAC_CLIENT_VERSION.test(version)) {
+    const helpers = client === "codex"
+      ? ["plugins/hellolynk-codex/runtime/platform/darwin", "plugins/hellolynk-codex/runtime/bootstrap/platform/darwin"]
+      : ["runtime/platform/darwin"];
+    for (const relative of helpers) {
+      const file = `${relative}/hellolynk-keychain-helper.bin`;
+      if (!manifest.files.some(record => record.path === file)
+        || (process.platform !== "win32" && !((await fs.lstat(path.join(root, file))).mode & 0o100))) throw failure("package_pin_invalid");
     }
   }
+  return { coreRoot: pkg.hellolynkClient.coreRoot, files: manifest.files };
 }
 async function verifyRecords(root, records, allowedExtra) {
   if (!Array.isArray(records) || records.length < 1 || records.length > 5000) throw failure("package_pin_invalid");
@@ -482,7 +495,7 @@ async function verifyInstalledContext(config) {
 function normalize(value) {
   const platform = value.platform || process.platform;
   if (!CLIENT_UPDATE_CLIENTS.includes(value.client) || typeof value.currentVersion !== "string" || !VERSION.test(value.currentVersion)
-    || (platform === "darwin" && (value.client !== "codex" || !MAC_CODEX_VERSION.test(value.currentVersion)))
+    || (platform === "darwin" && !MAC_CLIENT_VERSION.test(value.currentVersion))
     || !path.isAbsolute(String(value.root || "")) || !path.isAbsolute(String(value.installContext?.packageRoot || ""))) throw failure("configuration_invalid");
   const context = { packageRoot: path.resolve(value.installContext.packageRoot) };
   for (const name of ["nodePath", "dshProfile", "dshRoot"]) {